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Anecdotal evidence acquired through historic failure investigations involving rapid cabin 
decompression (e.g. Challenger, Columbia and Soyuz 11) show that full evacuation of the 
cabin atmosphere may occur within seconds. During such an event, the delta-pressure 
between the sealed suit ventilation system and the cabin will rise at the rate of the cabin 
depressurization; potentially at a rate exceeding the capability of the suit relief valve. It is 
possible that permanent damage to the suit pressure enclosure and ventilation loop 
components may occur as the integrated system may be subjected to delta pressures in 
excess of the design-to pressures. Additionally, as the total pressure of the suit ventilation 
system decreases, so does the oxygen available to the crew. The crew may be subjected to a 
temporarily incapacitating, but non-lethal, hypoxic environment. It is expected that the suit 
will maintain a survivable atmosphere on the crew until the vehicle pressure control system 
recovers or the cabin has otherwise attained a habitable environment. A common finding 
from the aforementioned reports indicates that the crew would have had a better chance at 
surviving the event had they been in a protective configuration, that is, in a survival suit. 
Making use of these lessons learned, the Constellation Program implemented a suit loop in 
the spacecraft design and required that the crew be in a protective configuration, that is 
suited with gloves on and visors down, during dynamic phases of flight that pose the greatest 
risk for a rapid and uncontrolled cabin depressurization event: ascent, entry, and docking. 
This paper details the evaluation performed to derive suit pressure garment and ventilation 
system performance parameters that would lead to the highest probability of crew 
survivability after an uncontrolled crew cabin depressurization event while remaining in the 
realm of practicality for suit design. This evaluation involved: (1) assessment of stakeholder 
expectations to validate the functionality being imposed; (2) review/refinement of concept of 
operations to establish the potential triggers for such an event and define the response of the 
spacecraft and suit ventilation loop pressure control systems; and (3) assessment of system 
capabilities with respect to structural capability and pressure control. 


Nomenclature 

psia = absolute pressure, lb-force per square inch 
psig = gauge pressure, lb-force per square inch 

I. Introduction 

T HE Constellation Program (CxP) Extravehicular Activity (EVA) System included the elements necessary to 
protect crewmembers and allow them to work effectively in environments that exceed human capability during 
all crewed mission phases. This includes protection from pressure and thermal environments, micrometeoroids, and 
the harsh acoustic and acceleration loads induced during dynamic vehicle operations, particularly launch, landing, 
and ascent abort. The Multi-Purpose Crew Vehicle (MPCV) Flight Suit, a part of the EVA System, provides ground 
support during pre-launch checkout and vehicle ingress; crew survival subsystems integral to the suit to support 
launch and entry functions; and vehicle interface equipment to support in-cabin unpressurized survival. This last 
function has led to the development of the “do not pop” requirement, that is that a suit must be operational after a 
rapid cabin depressurization event. In order to bound the problem, a depressurization rate intended to correlate with 
the depressurization rate experienced in the Columbia incident was defined. The requirement was stated as follows: 
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CxP 72002 EVA System Requirements Document 

[EVA2089] The Suit Element shall operate after a cabin depressurization event where the vehicle pressure decreases 
from the nominal 14.7 psia to 0.0 psia in 3 seconds (TBR-EVA-UCA2.1). 

Rationale: The EVA System represents the most straightforward solution for crew survival in the possibility of the 
vehicle sustaining damage during ascent or earth entry that creates a leak beyond what the vehicle ECLSS, to which the 
suit is connected via umbilical is required to respond to. Though the suit loop is expected to recover quickly (within 
minutes), the ventilation loop structural integrity must be robust enough to withstand the short term spike in pressure 
until the suit and vehicle pressure relieve valves can relieve the pressure to the Maximum Contingency Pressure, 8 psid. 

The intent of incorporating this requirement was to ensure that a capability perceived to be key to the MPCV 
Flight Suit design was addressed. There were no direct requirements received from the CxP to address this function; 
as emergency equipment, requirements associated with MPCV Suit functionality were often incomplete and cryptic. 
A study of previous suit system capabilities and stakeholder inputs led to the development self-imposed crew 
survival capabilities beyond what the Constellation Program (CxP) had directly allocated, including cold water 
survival and protection from fire and toxic environments. The parent of these self-imposed requirements is: [Ex- 
0034] The Constellation Architecture shall provide crew survival capabilities through each mission phase. (1) 

The effort to establish a precise, verifiable requirement for this capability proved challenging. Although the CxP 
Operational Concepts (Ops Con) indicated that a reasonable risk exists for an uncontrollable leak in the crew module 
to occur during dynamic phases of flight, the specifics of this scenario had not been defined. The CxP regarded a 14- 
inch hole as the only leak case relevant to design and did not address any scenarios that involve uncontrolled leak 
rates when the crew is already suited. An action was taken at the Orion Preliminary Design Review (PDR) 
Constellation Systems Engineering Review Panel (CSERP) to define the size hole that the system could handle. 

Anecdotal evidence from historical catastrophic events led stakeholders to conclude that protection for a 
depressurization event should be considered and it should accommodate evacuation of the cabin atmosphere within 
seconds; this intent is currently conveyed in the requirements. 

C-SAFE interpreted this requirement to mean that the suit must either incorporate controls to ensure it does not 
exceed its Maximum Contingency Pressure (MCP) (9.0 psig) by incorporating a large relief valve (RV), or that the 
suit structure must be augmented such that the MCP is set to the maximum pressure the suit could see during this 
event. This equated to a 22 psig proof pressure. Both of these options would have significant impacts on the suit 
design. The larger relief valve would add mass to the suit and would be difficult to place on the suit without risking 
injury to the crew during launch and landing. The augmented structure of the suit would also add mass, and would 
impact the flexibility of the suit. 

Given the disconnect between the contractor’s interpretation and the intention of the requirement, an action was 
made to clarify the requirement. This report provides the details of that effort. 

II. Analysis 

The first part of executing this task involved an analysis. First, the stakeholders’ expectations were evaluated to 
validate the imposed function. Then the Ops Con was reviewed and refined to gain a better understanding of the 
scenario and derive the desired system performance. Finally, an assessment of the sut and vehicle capabilities were 
performed to understand the baseline performance. 

A. Stakeholder Assessment 

The key stakeholders considered in this portion of the evaluation were the CxP and NASA Safety and Mission 
Assurance (S&MA), the organization responsible for human health and safety. Other stakeholders important to 
flight suit development were consulted, including crew survival subject matter experts (SME). 

1. CxP Expectations 

As discussed earlier, per Ex-0034, the CxP expects that crew survival capabilities be provided throughout each 
mission phase. With respect to survival in an unpressurized cabin, the CxP was focused on the contingency 
operations associated with a slow rapid cabin depress where the leak rate was equivalent to having a !4-inch hole. 
No further direction was given to the EVA System on performance expectations during scenarios in which an 
uncontrolled leak or a leak rate greater than the equivalent 14-inch hole was provided. ITowever, according to the 
following CxP Ops Cons, it was clear that the suit was expected to protect the crew from a rapid depressurization 
event. 
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CxP 70007, Constellation Ops Con (Rev. C) 

5.3.4. 1 Launch Operations, Ares I/Orion: Prior to launch commit, remaining final configuration and automated 
verification of systems is completed and the integrated stack is ready for launch. Crew visors are down and gloves are 
on. 

5.5.1 LEO Configuration: The crew will be suited with gloves donned, but visors may be up for the docking operation. 

5.9.2 Earth Arrival Operations: The entire crew dons suits in preparation for entry with gloves on. Prior to entry interface 
the crew visors are down. 

2. Human Rating Plan - Tenet 3 

The NASA Human Rating Plan was taken as a description of the S&MA expectations. According to Tenet 3 
described in the document: 

When developing spacecraft to carry humans, the design team incorporates capabilities and safeguards that allow for the 
safe return of the crew after system failures prevent mission continuation. Additionally, whenever practical, the system 
provides capabilities for the crew to survive potentially catastrophic hazards, catastrophic events, and emergency 
situations. (2) 

As described above, the CxP had chosen to include the MPCV Flight Suit during high risk portions of the 
mission in order to increase crew survivability. The extent to which the suit protects the crew must, however, fall 
within the realm of practicality. Based on Tenet 3, S&MA advised that the safety of the crew during nominal 
mission operations must not be compromised in order to protect against improbable events. 

3. Crew Survival SMEs 

After some discussion, it was clear that the crew survival SMEs expected to, as much as possible, incorporate the 
relevant lessons learned from the Columbia Incident. 

3.4.3 - 1. The first event with lethal potential was depressurization of the crew module, which started at or shortly after 
orbiter breakup. Existing crew equipment protects for this type of lethal event, but operational practices and hardware 
limitations were such that the ACESs were not in a protective configuration. ... (3) 

The investigation team concluded that Rapid cabin depress was identified as one of five events contributing to 
the Columbia incident fatalities and that rapid depressurization of the crew would have been mitigated had the crew 
been in a “protective configuration.” (3). Space Shuttle Crew Escape Hardware engineers confirm that the 
Advanced Crew Escape Suit (ACES) would have been capable of mitigating rapid depressurization as a fatal factor. 
From this, it can be concluded that the suits are expected to protect the crew in case of a rapid cabin 
depressurization. Note that other events with lethal potential were identified, for which the suit played no role in 
mitigation. 

4. Conclusion to Stakeholder Assessment 

It was concluded that the function to protect the crew in the case of a credibly rapid cabin depressurization is 
valid. The definition of “credible” is the subject of subsequent recommendations. 

B. Review/Refinement of Concept of Operations 

The EVA Ops Con provided some explanation on the intent of the requirement: 

The suit design is expected to protect the crew from fire and asphyxiation, making use of the lessons learned from 
historical incidents such as the Challenger, Columbia, and [Soyuz 11], In the case of a rapid cabin depressurization, 
anecdotal evidence acquired through previous failure investigations show that full evacuation of the cabin atmosphere 
may occur within seconds. It is possible that pennanent damage to the suit and suit loop components may occur as the 
integrated system may be subjected to delta pressures in excess of the design to pressures. However, it is expected that 
the integrated suit loop will maintain a survivable atmosphere on the crew until the vehicle ECLSS recovers or the cabin 
has otherwise attained a habitable environment (<18 K ft altitude during landing). (4) 

It was determined that the depressurization rate had to be refined. To do this, credible triggers to a rapid cabin 
depressurized were identified and analyzed. 
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1. Identification of probable rapid cabin depressurization events 

One of the possible triggers for a rapid cabin depressurization event is structural damage. A breach in the crew 
cabin structure could result from a low velocity impact as a result of a docking failure or other low velocity impact 
with another space object. The resultant leak cannot be predicted. A breach could occur as a result of a 
hypervelocity impact by a micrometeoroid or other orbital debris. Due to the large energy involved in such an 
impact, the crew module could be destroyed. A hypervelocity impact that does not destroy the crew module could 
cause or exacerbate rapid decompression due to secondary failures such as sealing problems and short circuits. The 
extent of damage to the MPCV from an impact can result is any type of leak from undetectable to instantaneous; 
secondary effects due to energy transfer, thermal effects or leak propagation cannot be reasonably quantified. 
Therefore further effort to try to quantify this scenario seemed impractical. However, anecdotal evidence from the 
Challenger and Columbia incidents could be used to bound the problem. 

The Challenger crew became incapacitated quickly and could not complete activation of all breathing air 
systems, leading to the conclusion that an incapacitating cabin depressurization occurred. 

Columbia: No conclusion could be drawn as to the rate of cabin depressurization based on medical evidence. 
Conclusion Ll-5: The depressurization incapacitated the crewmembers so rapidly that they were not able to lower 
their helmet visors. Based on this timeline documented in Figure 3.4-15 of the Challenger Crew Survivability 
Report, depressurization occurred in 24 - 41 seconds. This timeline was built on very strict criteria for conveying 
data. The actual depress time was probably more like 15-20 seconds. 

A more quantifiable scenario is the inadvertant opening of a valve that connects the crew module to vacuum due 
to either a system failure or an operator error. The Soyuz 11 incident represents a case study in inadvertent valve 
operation. In this case, the crew module depressurized to 0.0 psia in about 3.5 minutes. (5) The valves that connect 
the MPCV CM to vacuum are listed in Table 1. "MPCV Valves that Link the CM to Vacuum. “ 


Table 1. MPCV Valves that Link the CM to Vacuum. 


Description 

Leak Path Size 

Depressurization Time 

Positive Pressure Relief valve (PPRV) 

3 in. flow path 

49 second depress to 1.0 psi 

Negative Pressure Relief Valve (NPRV) 

5 in. flow path 

17 second depress to 1.0 psi 

Snorkel Inlet Vent 

5 in. flow path 

17 second depress to 1.0 psi 

Snorkel Outlet Vent 

5 in. flow path 

17 second depress to 1.0 psi 

Manual Docking Adaptor Equalization Valve 

<1.0 in. flow path 

>6.75 minute depress to 1.0 psi 

Manual Side Hatch Equalization Valve 

<1.0 in. flow path 

>6.75 minute depress to 1.0 psi 

Docking Adaptor Motor Valves 

<1.0 in. flow path 

>6.75 minute depress to 1.0 psi 

Waste Management Urine Vent Line 

<1.0 in. flow path 

>6.75 minute depress to 1.0 psi 


2. Suit Loop Response 

In such an event, the crew is assumed to be in a “Protective Configuration”; suited, seated, and connected to 
vehicle life support and communications. The crew is assumed to be at “vent pressure” - 1.0 psid over 14.7 psia 
cabin pressure. There are two other suit pressures that were not evaluated: leak check pressure where the suit is at 

2.0 psid over 14.7 psia; and during decompression sickness treatment where the suit is at 8.0 psid over 14.7 psia. 
Once the catastrophic leak occurs, the cabin and suit -loop depressurize at varying rates. Since the delta-pressure 

is above that of the suit loop set-point, no make-up gas will be added by the MPCV Environmental Control and Life 
Support System (ECLSS). 

The suit relief valve opens when the suit loop pressure exceeds 8.4 psid. In the worst case scenario evaluated, 
the depressurization rate is too high for the suit relief valve to keep up; the suit pressure can exceed 13.5 psid and 
then depressurizes once the RV catches up to the depressurization rate. The suit should return to within the MDP at 

9.0 psid in about 15 seconds and the relief valve should reseat once the suit pressure reaches 8.4 psid. The suit loop 
should, after detecting the cabin leak, regulate suit-loop pressure at the prebreathe pressure (8.0 - 8.7 psid). 

The prime contractor estimated the pressure response to such an event. 
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Suit can handle depress in Current suit architecture cannot 
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Figure 1. Suit and Cabin Pressure Profile. MPCV CM and suit pressure profiles assuming three different 
depressurization rates. 

The following figure shows the estimated time for crew module depressurization as a function of the effective 
hole size. This chart was assembled utilizion the Killerpress Model assuming a 550 ft3 cabin volume at 14.7 initial 
pressure. The derived hole sizes were compared to those predicted by the prime contractor’s model and found to 
trend consistently with acceptable deviation. 



Orion design Crew Module Breach Effective Hole Size (Cd-1.0), inches 

protects for up to a 
quarterinch hole 

Figure 2. CM Depressurization Rates. 


Once the pressure in the suit loop stabilizes, the suit is expected to hold pressure. Additional capabilities 
include communication and some mobility to pilot the vehicle to the International Space Station, ISS. A Rapid 
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Cabin Depress ends the mission. The suits are expected to operate until they reach safe haven, but are not expected 
to operate nominally, nor would they be certified for use afterwards. There should be no impact to performance on 
the vehicle side of the suit loop. 

C. Assessment of system capability 

It was concluded that the design of the MPCV was appropriate to address credible rapid cabin depressurization 
scenarios. The analysis indicated that the suit design can handle a cabin depress from 14.7 to 1.0 psi in < 3.4 
seconds. The resultant requirement was set at a 5 second depressurization event in order to provide some margin 
between the initial performance estimate and the requirement such that small changes in the model or in vehicle or 
suit assumptions will not unnecessarily impact suit design. The 5 second depressurization rate (or equivalent 9-inch 
hole) still covers the majority of the credible triggers to a rapid cabin depressurization, including Columbia and 
Soyuz fatal depressurization. However, the interpretation of the requirements remained a challenge; a review of the 
programs structural design and verification requirements had to be reviewed and clarified. 

This scenario is akin to crew survival after exposure to crash loads, in which case it is appropriate to address the 
scenario without margin, e.g., impose a Factor of Safety (FOS) of 1.0. Per NASA-STD-5001A, the ultimate 
strength is the “The maximum load or stress that a structure or material can withstand without incurring failure’’. 
Per the CxP Structural Design and Verification Specification, CxP 70135, Table 3.10.1-1, Minimum Factors of 
Safety for Structure, Section e: Indicates a minimum FOS of 1.5 for emergency events (1.2 Proof/ Acceptance 
Testing proving 10.8 capability); in Section 3.10.2 it states that program-defined emergency design loads shall be 
applied an ultimate FOS of 1.0. (6) 

With these definitions in mind, it was concluded that a rapid cabin depressurization from 14.7 to 1.0 psia in < 30 
seconds should be considered as an “emergency event”. Though no design margin would be required to cover the 5 
second CM depressurization, the suit and crew survival SMEs concluded that some design margin should be 
established for this case (and for emergency cases in general). The community decided on an FOS of 1.1 which 
came from the current ISS Extravehicular Mobility Unit (EMU). Forward work needs to be performed to validate 
its appropriateness and to evaluate the impacts (if any) to the suit 

The community agrees that degraded performance is acceptable; however, some minimal performance in key 
areas (pressure retention and mobility) is expected until the crew can be rescued or can otherwise be transferred to 
the ISS. Definition of this performance was taken as forward work to be performed in parallel with the prime 
contractor’s action to characterize how suit performance will degrade if subjected to such a pressure load. 

Credible scenarios still exist beyond the design range of the suit. In keeping with the spirit of Tenet 3 of the 
Human Rating Plan, the current pressure robustness in the suit design beyond what is required should be pursued to 
maximize crew survivability. 


III. Conclusion 

This task confirmed that crew protection from a rapid cabin depressurization event is a capability the LEA Suit 
provides. The ops con and system capability assessment showed that the system would be capable of protecting the 
crew during all credible and quantifiable events. The requirement imposing this functionality had to be updated to 
clarify its intent and establish appropriate performance expectations. 
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